iirc that one also suffered from the do-security-before-knowing-which-domain issue, but I might try coding it and seeing if it actually blows up or works. I've found a few things already which the manual says don't work but in practice seem to do so