Only allow embeds on media_domain.

This prevents leaking of modhashes etc. from logged-in embeds.