I think their point was that the concept could be expanded as per their suggestion, as a simple way to fix the security issues.

Having the server send a 'this is my site base' header would be helpful even without having path support. At the moment, browsers need to magically know about all multi-level domains, like example.co.uk, so that they don't lump together all *.co.uk domains as the same site.

Yes, this was my meaning - apologies if i wasn't clear.