gmail - how to enable xss requests only for google gadgets -

I am creating a Google Gadget application for which my server needs to be interacted, however, To enable, cross-domain requests need to be enabled on my script:

Header ('access-control-permission-origin: *');

I like opening requests that originate with Google only, but setting the following values ​​does not work: header ('access-control-permission-origin: google.com');

What settings should I do to make Google Gadgets work?

Answer 'gmodules.com', 'Basic' headers out here which I caught in the Firebug console.