See message to fossil-users] from Kyle McKay describing one (largely untested) quick hack to get this effect. I plan to play with this a little myself since I would like to not loose sessions when working with tickets on my internal server over a VPN from home.

The big web community sites do this (e.g. facebook, Yahoo, Google) and don't seem to be hugely worried about security issues so it must be possible to achieve. Whether it is practical to achieve and still maintain "enough" security is not obvious to me.