Never co-host real applications and user controlled sites on the same root domain. You're just asking for a neverending stream of problems. (This is why everything ends up on googleusercontent.com and friends instead of google.com)