Is it not possible to set document.domain to herokuapp.com? How?
While document.domain is not specifically addressed this article from Heroku explains how and why this works.
tl;dr
Why: It's dangerous.
How: herokuapp.com is included in Mozilla Foundation’s Public Suffix List