Tests origin allowlisting subdomain behavior.