Basic callback management

  - Consumers now have a domain field, which is the domain they own.
  - The default callback manager will check for that and will permit
    callbacks matching that domain name.