[http-state] Closing Ticket 6: host-only cookies

[Adam Barth <[e-mail]>]

Discussion about Ticket 6 seems to have quieted down.

== Summary of Discussion ==

Daniel Stenberg argued that we'll be stuck with IE's behavior for a
while, so we should spec that implementing host-only is optional.

Maciej Stachowiak suggested that we not assume Microsoft won't
implement host-only without actually hearing it from them.  (Note:
Microsoft neither committed to implementing host-only nor refused to
implement it.)

Dan Winship suggested that we should require user agents implement
host-only cookies but that we should warn servers that some legacy
user agents don't.

Roy T. Fielding argued that the security benefits of host-only trumped
IE not implementing host-only.

Blake Frantz supported Dan Winship.

== Resolution ==

I've changed the spec as suggested by Dan Winship and supported by Roy
T. Fielding and Blake Frantz.  To wit:

1) User agents are required to implement host-only cookies (matching
the behavior of Firefox, Chrome, Safari, and Opera).

2) The spec warns the reader that some legacy user agents (in this
case IE) do not implement host-only cookies.

I've pushed a new version of the draft with these changes:

http://www.ietf.org/id/draft-ietf-httpstate-cookie-03.txt

We can re-open the issue if someone presents material new information.

Adam