Domain restriction for AJAX queries