Yes sorry, RIA is JavaScript to me. I mainly work on web-apps, and they are JavaScript intensive. The security constraints but in say that accessing services.mydomain.com is like accessing yourdomain.com so JavaScript balks at it because it views it a a cross site call. So fir simplicity sake you end up just doing mydomain/services/customer1. It is semantics but I would love to put all of my services on a sub-domain and have browser based JavaScript be able to access it. It would make moving that logical sub domain off to an app server easier as it is a DNS entry as opposed to routing rules for the /services sub folder on the domain. For SaaS it would be a god send because for each client you could set up a virtual host that pointed services.clientdomain.com to the hosted app server and provide managed services for a client with just a simple DNS entry. As it sits now, the client has to set up configurations to forward /services to the managed services. For me and what I do, allowing JavaScript XHR calls within the second level domain would simplify some things. The problem is it assumes trust across a domain and that does not hold true for larger entities, for example say you have bigco.com and it has hr.bigco.com. You really don't want all of the enterprise to be able to access sensitive HR services so that is why you get the current model. I just wish it was configurable per domain.