don't allow ota restore from a url not in your domain