Is there a design purpose to making the allowed origins include subdomains by default? One quirk I noticed is that an incomplete ip addresses are a bit odd with the subdomain logic.