Unfortunately subdomains are not secure either, because subdomain is allowed to place cookie for the whole domain, performing session fixation attack:

http://skeptikal.org/2009/11/cross-subdomain-cookie-attacks....