Make verify domain check automatic (not an option).  Change to a subdomain check instead of a same-origin check.