wrong check for allow all domains: