If someone can host arbitrary html and js on the *.github.com domain, they can set cookies for github.com. See http://homakov.blogspot.com/2013/03/hacking-github-with-webk...