title: how to enable xss requests only for google gadgets
body: <p>I'm building a google gadget application that needs to interact with my server.  However, I need to enable cross-domain requests on my scripts to allow for this:</p>
  
  <p>header('Access-Control-Allow-Origin: *');</p>
  
  <p>I'd like to only open up requests originating from Google but setting the following value does not work:
  header('Access-Control-Allow-Origin: google.com');</p>
  
  <p>What should I be setting to make this work for google gadgets?</p>