Cookies are associated with the domain name, and all our webapps are run from the http://localhost domain. They use different ports but cookies, per design, work across different ports (with the only exception of port 443 for SSL-only cookies).

The result is that one webapp can see cookies set by another webapp for the locahost domain.