fix wildcard-domain matching
add much smarter validation of domains (fixes #1)