[snarfed]yup. I think the short answer is no, it doesn't add fundamentally new or different security concerns, but it is obviously more effort to make everything work ok. eg cookie-based auth will only work on the domain where the cookie was initially set, etc
