`[...]make the code responsible for validation as difficult as possible to find and break` ⌘+W Seriously though, this seems like an convoluted way for small bu

`[...]make the code responsible for validation as difficult as possible to find and break` ⌘+W Seriously though, this seems like an convoluted way for small businesses to resolve trust issues with their clients. I mean, if you really want to do this, why not make it incredibly simple and just ping a server with the domain names the web app is being requested from. Do it all silently and then let the IP owner decide what to do about it. Why shut the site down and risk embarrassing, and potential trust destroying, situations arise from false positives?