Cross-domain is needed, otherwise an app/webapp couldn't talk to the bridge since the bridge only serves the REST API.

However in order to send control commands and query light states the app/webapp needs to authenticate and create a account, which is only possible for a few seconds after pressing a physical bridge button.