I would that customer x couldn't authenticate using virtualhost of customer y (or primary domain). 
In other words virtual host could only authenticate users of the same domain. 
 
This can be also accomplished (for example) quite simply with implicit ( transparently for user) append of @customerdomain.tld to username... 
 
This also avoids having to type in the domain name every time as well. 
 
It would be great to have this feature in future releases as well.