Someone finally realized that yes, you can take the subdomain part from the URL and use that as the key in a DB lookup. Then just keep doing that on each pageload. No need to pass the code in a hidden field.
Don't ask why we didn't start with that idea. That got shot down harder than the hidden field.
fml