Make API inaccessible from subdomain, closes #219