Ok, found the solution to the cookie problem.
See XHR specsXHR specs, jQuery docs and StackOverflow.
The solution to have the cookies sent when switching protocol and/or subdomain is to set the withCredentials property to true.
E.g. (using jQuery)
$.ajax( { /* Setup the call */ xhrFields: { withCredentials: true } });