"1st-party" is domain, not hostname