This bug is a catch-all to fix up cookie behavior inside signed packages. We need to decide what to do with: - set-cookie headers (i.e. ignore them if they are set inside the package?) - ensure the loading web content inside a package is in the web cookie jar - ensure that loading package content inside a package inside the package's cookie jar Could jsut always return "" when access document.cookie? But what if a package sets something here and expects it to be returned later....

If we are moving to unpackaged apps, we are close this...