in fact, cookies legible to anything except the single sandboxed webpage running on your local browser would be illegal and thus never exist to begin with

I like it, but we'd need to find a new way to do auth (and then prevent that from being used for non-auth-related tracking)