> What if we have two domains on the same network? the request already has the domain name built in, and we check it. > and for fully paranoid, we need to check, if trust account exists > :-) why? I don't see anything that this gains us. It certainly doesn't help with security.