understanding first/third party cookie behaviour scenario 1 set cookie from foo.example.com with no domain is it readable by foo.example.com? is it readable by bar.example.com? is it overwritable by bar.example.com? scenario 2