I double-checked the wireshark captures after the bugfix and it is sending (just) the proper cookies, and not any out-of-domain ones. So it seems to be working as you'd expect.

PS: There's one other place in your .pm (save_content) where perhaps this PERSIST_FLAGS_FORCE_ALLOW_COOKIES should be added as well. Just search on the other instance of PERSIST_FLAGS_FROM_CACHE. I don't use that other function, so I haven't tested it.