Configure the Domain cookie attribute which instructs web browsers to only send the cookie to the specified domain and all subdomains

Basically, this is what we are using (though we also have an iRule that intercepts logoff pages to ensure removal of these cookies too). I think we set a variable in access policy completed to check here and do this so you don't have it adding every time, just when the policy completes and the user is logged in.

when HTTP_RESPONSE_RELEASE {
     Might could use HTTP_RESPONSE instead of HTTP_RESPONSE_RELEASE

    set sid [ACCESS::session sid]
    set domaininfo ".[domain [HTTP::host] 2]"
     Domain needs the prefixed "."

    HTTP::cookie insert name "MRHSession" value $sid path "/" domain $domain
    HTTP::cookie insert name "LastMRH_Session" value [substr $sid [expr [string length $sid] - 8]] path "/" domain $domain
}