Same issue here. Didn't seem to be able to get a wildcard working, so even though we made the exception for https://app.schoolcomms.com and https://app.schoolcomms.com/login we then couldn't navigate to any of the sub pages such as https://app.schoolcomms.com/management without explicitly adding that.
How did you manage to get around that?