Ideally, everything related to sessions and domains. The security model we operate under on the web is completely outdated, which adds a ton of complexity to everything else.

Secondly, I would look into cutting out all the parts of the HTTP protocol normal websites aren't commonly using to reduce the complexity of the implementations.

A lot of things HTTP does are probably better off being move to other protocols altogether.