allowing multiple domains for authenticated routes