Access restriction: domain vs path matching regexes?

I want to use the HTTP request field to block Facebook, but not news articles about Facebook. The docs say that the field uses regexes, but I've tried and failed to write a a regex that matches Facebook in the domain but not elsewhere in the url. It appears to me that the field is matching dumb strings, not regexes at all.

Can anyone confirm a list of operators that will actually work in this field? Does anyone have a way to match strings in the url's domain, but not in the path?