domain support, strict requirements for loginURL and secretKey