domain restriction added for cookie based oauth

I've added domain restriction to the cookie based success handler for oauth.

Presumably I should do the same for token based auth.