Tests origin whitelisting subdomain behavior.