Question: why are visualforce pages served from a different domain?
Answer: “ 162 : Why are Visualforce pages served from a different domain? Ans : ... “The move to separate domains has one very specific purpose: leverage the browser security model (same domain policy) to protect our customers and the salesforce.com service from cross site scripting and cross site request forgery attacks.