But how to steal cookie cross domain? Possible?