Exactly - if you have a combination of trusted and untrusted subdomains, like

  www.mysite.com
  support.mysite.com
  wordpress.mysite.com

Then it's impossible to give only certain ones access to your session cookie.

You could use *.secure.mysite.com for all internal apps, but that seems ugly. You could also not use subdomains for any internal apps, like Google, but that's limiting in other ways - notably, it makes it impossible to have any security isolation between internal apps.