Session state persistence between web page content

Question

I already posted to Apple's Safari dev forum but got no responses so thought try cross posting elsewhere to get ideas:

I'm asking this question in regards to both

Safari Extension (toolbar type AJAX extension) Mac OS X dashboard widget

I assume both will be similar as they use the WebKit rendering engine?

I would like to know if the engine for maintaining built in session state support (cookies?) shares and persists the session between web content loaded on the page by the browser engine (HTML, JS, CSS, images, etc.) and requests made by XmlHttpRequest object.

I'm porting an AJAX app that requires session state that's shared between web content and XmlHttpRequest object. (i.e. no explicit cookie management for session state, at least not defined by the web service API that I use).

I successfully ported the app to Chrome, Opera, Windows 7/Vista gadget. It failed to work on iGoogle, and Mac OS X widget. Safari extension port had mixed results - it works in some cases but not in others.

I also did a Microsoft .HTA port (HTA app = web app to be run via IE w/o security restrictions of normal web apps, like cross domain XmlHttpRequests) and noticed that works only with IE7+ (due to implementation differences of native XmlHttpRequest in IE7+ vs MS XML version of earlier IEs)

I had consulted discussion/support group for iGoogle as well and learned that iGoogle too doesn't support such session state support.

I kind of worked around iGoogle issue by using Flash component to perform XmlHttpRequests which seemed to be able to share the overall browser session and thus work. I'm attempting that for Mac widget, it didn't seem to work. Can Safari toolbar extensions make use of Flash?

In any case posting this thread for more insight like if Safari/Mac is like iGoogle and not support a shared session between web content and XmlHttpRequest (or no cookies even supported).

FYI, the app I'm working on is below, you can try out what I have to investigate issue. When session state support fails, you get error message that need to enter code correctly (that's what the web service returns in this case, not very helpful to the user).

http://code.google.com/p/autosmsclients/

I've already hosted code for Mac OS X widget and Safari extension there.