title: Google's OAuth2 requirement that I own the domain
body: <p>Would someone give me a brief explanation for the necessity of "owning" a domain from which a Javascript app is served that makes OAuth2 calls to a service running on App Engine? I assume this is meant to prevent some security vulnerability. I just can't imagine what, since the Javascript authenticates with the service using the client running in the user's web browser, and the auth flow makes it clear what the user is being asked to allow. What difference does it make where the page comes from?</p>