"it's never a good idea to point a QR code to a fixed domain" why not?