Security.allowDomains & wildcards

Got bit by this today: The Flex function Security.allowDomain() can handle "*" as its parameter but not "*.site.com". It would be handy if it did since we don't know ahead of time exactly which domain names our partners will have (especially for dev work) but it makes sense since site.com may not own all domains that end in "site.com". Live and learn...