Restrict credentials to multiple domains