Facebook <securecookie> rules break apps

As reported here:

We now need to work out whether there is a subset of cookies that we can secure to prevent account hijacking while still allowing apps to function :(