Opera Browser (Presto engine) used to default to "Block third-party cookies", rather than "Accept all cookies". If I remember correctly, this subtly broken enough sites that they relented and changed the default.

I think that would be a good option. Allow first-party cookies for session tracking (logins, etc) but block third-party cookies.

Another way is to not use cookies at all and rely on local storage to store an authorization token. In fact, a site that I work on does this. We don't store your session in a cookie at all. Your token gets passed to API calls which return data for your user.