don't allow ota restore from a url not in your domain
Merge pull request #1233 from dimagi/cz

don't allow ota restore from a url not in your domain