note that for updates to work, we keep the secondary domain optional, even though they are really not. part of #809
Girish Ramakrishnan