don't use media, asset subdomains (SSL cert not wildcard)