Got around the subdomains with the following line, which I should've known:response.cookies("cookie").domain="."&replace(request.servervariables("server_name"),"www.","")
After some more research it doesn't look like there's an easy way to share cookies across domains without using some complex and ugly hacks.