Default this to true. For this to work, this requires EnableCrossDomain to be set and for the request to be coming from the same second-level domain. I don't see why we should make this any harder for no security benefit.