Better error styling.
Prevent 'demo' as a site name.
Use the configured site's urls to control CORS. Theoretically safer than allowing the whole world access.
Check that a site's url matches the origin from the request.