hosted-app origin reserved