admin: ensure groups are more nicely stacked
domain: try to ensure robustness of the chromecast subsystem with domains

There is something fishy with the TLS stuff. It seems that if we get a
ECONNRESET error on the TLS client, we may manage to get a repeated
error while the handler is gone (inside `tls.js`). We want to avoid
that. Let's use a domain for that.

It would be better to only catch this error at the very beginning.