While I agree with most of your points, I disagree with

> Doesn't play nice with password managers.

Check your password manager settings. Most have options to match on domain, subdomain, port or have the ability to set equivalent domains either globally or per credential.