Can't speak to the ability to break out the username.domain.name bit from the code (I imagine it's possible), but there's a reason for it - it's so that people can't steal others' cookies, which use a host.domain.name format for trust. So kraig.dreamwidth.org can't see whobutdrew.dreamwidth.org's cookies with some malicious code, but dreamwidth.org/kraig can write some malicious code to see whobutdrew's cookies, if this theoretical malicious kraig could trick poor whobutdrew into visiting a page that had it. So unless you can explicitly trust all your users, I'd hold off on your plan.