From which perspective does "allow-access-from domain" apply?  If this is the client perspective, then should the domain be set to the m-lab vserver hostname?  If this is from the server perspective, then '*' is probably the right thing.