Same as for service requests.
The requests from the roundcube kolab plugin are not arriving
necessarily via the domain, but are in general handled like other
service requests. Maybe we should just remove the domain check for all
api calls, but then we need to make sure that admin./reseller. api calls
still do what they are supposed to.