We need better methods to protect html5 exports.
As it stands we have two expressions from the Browser object, those being domain and referrer.
There are issues to using both of those.
Browser will work if, and only if the page is by itself on a host, however a great many portals require you to provide a url so that they can embed the game in an iframe.
This means that browser.domain will only return the source of the iframe, and not the url of the page where the iframe is hosted.
That makes it useless for this case.
We also have browser.referrer, which is a step up, but it also presents an issue as most portals will have diferent reference urls, based on search queries, member details, cdn, etc. Then unfortunately these portals are not in the habit of providing what all these urls will be, let alone any method to protect your games.
We need a way to get the parent domain.