> a site can't set basic auth for you

That probably would've been added...

... and then we'd have essentially a single cookie per domain with wholly different higher-level semantics (user control through a password manager.) That ... actually sounds preferable?