Yes, that could still be a problem - hence my attempts to find out what the true server name is, using a clumsy PHP script. Here’s a related question: the config.php allows me to configure trusted domains but what I seem to understand here is that these are full server names, i.e. not ‘mydomain.de’ but rather ‘www.mydomain.de’ - is that right?