The pathname "/a/google.com" means it does come from within Google.

No, it doesn't. You can put any valid Google Apps domain there.

See: https://docs.google.com/a/google.com/document/d/1MBxYZ9C51t9...

If you're logged into a Google Apps domain it will change the google.com to match your domain. If you're logged into a regular Google account it will remain as google.com.

Thanks for correcting me. I never realized this.

Doesn't that make the whole /a/foo thing useless and misleading?

The domain name being Google.com means it is protected by Google's security policy.

But don't necessarily trust links inside that doc...