Wow, so now.sh , herokuapp.com and a few other hosts have their domains as “public suffix” which means .now.sh is just the same as .com, which means…

Wow, so http://now.sh , http://herokuapp.com and a few other hosts have their domains as “public suffix” which means .now.sh is just the same as .com, which means you can’t set a cookie for an entire TLD.

https://github.com/publicsuffix/list/blob/master/public_suffix_list.dat#L12689

Huge thanks to @bowersbros