Using images.wikipedia.org I see one open issue: Login cookies are currently set to the full qualified hostname, e.g. en.wikipedia.org. The browser would not send the cookie to images.wiki[pm]edia.org.
Should we create a unified user database for all wikimedia projects and set the cookie to *.wikipedia.org?
Why does this matter, though? We don't do anything with images based on somebody's user info, do we?