putting here an '*' will make security checkers to complain, we need to post the message explicitly to the app domain itself