Preventing cross-site attacks using same-site cookies
blogs.dropbox.com