What we do for Nordcraft, is logging in on nordcraft.com. The cookie we store for authorization will then also work on subdomains (app.nordcraft.com, editor.nordcraft.com, docs.nordcraft.com, blog.nordcraft.com and forum.nordcraft.com). If we logged in on one of the sub domains, the cookie would not be valid for the other sub domains