Cookies that are used to maintain session state must have a limited scope.

Using JavaScript track users by their session id,  means you can't use the httpOnly cookie flag. Scoping cookies to *.foobar.com means that XSS on *.foobar.com could compromise this cookie value. Or to put this another way, if a session id is scoped to *.foobar.com and doesn't have the httpOnly flag, then every domain on *.foobar.com is permitted to compromise a session using XSS.  In the context of PCI compliance,  this specific design would greatly expand the attack surface that needs to be regularly validated.  

One solution is to use another randomly generated token for the purposes of tracking users, and then protect the authenticated session id as a separate cookie value. 

Conversant, CNAME, Cookies, and PCI complaince
I am thinking of getting a streamlined FHA 203k loan for a home. The loan is for $101,300. The best offer I could find is 4% interest, but because of required insurance fees, I would pay $630.13 a month for 360 months. In the end, I will end up paying $226,846.8. I was told that after a year I could refinance to a conventional loan with a lower rate (currently at 3.75%) and ditch the mandatory FHA mortgage insurance fee (currently $113.05).

Assuming the interest would be lower than what I have now 4%, hopefully staying at 3.75%, would it be wise to refinance after a year so I can loose the $113.05 required mortgage insurance fee and hopefully lower my monthly payments or just keep the loan as it is. Since I guess the new refinance will take into account the original loan amount plus the interest. Please correct me if I am wrong. There is a $25 Hazard insurance fee in the monthly payment which I doubt I can get rid of.
