lock down domains allowed using configuration file