How does LJ prevent cookie stealing?

[shivku]

Blogger does it by safely having two domains. Does LJ believe in it's HTML filtering module so much ? Or is there something I am missing?