Cookie Scopes

I've re-read the portlet spec on cookies several times now and one thing is still not clear, how are cookies set by portlets scoped?

It seems like there are a few options:

1. Cookies are scoped the same way Preferences are, to the instance of the portlet entity
2. Cookies are scoped at the definition level, essentially Portlet A can share a cookie among any number of users but Portlet B will never see it
3. Cookies are not scoped at all. All portlets work in the same general space for cookies and a cookie set by Portlet A can be seen by Portlet B

Any thoughts on the intent in the spec?

-Eric