sounds like that's an obvious loophole to get around the protection then if they did allow same domain only

edit: no I'm wrong, it's early here and I've not had coffee