comment on validating callback request domain