This serves the web-dev surface iFrame from another domain, such that user-created levels can't sniff cookies from a visitor to their page. It forces a redirect if a path is accesses through the wrong domain.
Use ENV variables for hostnames
Allow messages from all relevant domains
Use the right iFrame URL for different domains
Let the load balancer check /healthcheck
Add special handling for china server
Generalize subdomain handling