Re: Sub-origins

Like Michal, I also dislike the hash/hmac based serialization approach. I
think some of the simpler serialization approaches discussed in this thread
work better, if we agree that a single serialization is necessary (I am
still not sure on that front). It feels more "webby" to have a human
readable serialization of the security principal instead of a HMAC.
Finally, as Dan's email points out, it doesn't look like the simpler
serialization should cause lots of issues.

Create a document.location.suborigin ? Then if it's undefined sites can
>

+1

~Dev