Add note about allowed domains being required