allow limiting of hosts for X-Domain download