allow indieauth logins, domain claiming and excluding