At some point we used to have support for ${subject} for accessing the domain management HTTP interface. Does anybody remember why it has been removed? Looking at the current domain API handler implementation it seems CORS has been explicitly been prevented.
Regards, Heiko