You're right: we could only really be certain of the domain on one side of the pipe (where `embed.js` lives). I just discussed this topic a bit with @mjschranz, and we're probably safe just using a `*`. We're not sending/receiving sensitive data anyway.