I think you bring up a good point, but there important security reasons for the separate domain for the wallet app. I think the real solution is making sure that everyone knows that this other domain is safe and secure, in fact it is safe and secure because it is a separate domain. Most users won't notice the domain name change and for those users security will go way up as a consequence of this change. For those users who are more aware of security risks (kudos for being one such user) we should make sure they know that this is a trusted domain, but as they are by definition the more educated, I don't think that should be a huge problem. Again, great points and thanks for the thoughtful comment.