How do you do hotlink protection for sub.domain wildcards?