Issue #2221699 by mpdonadio, mikey_p, alexpott, kim.pepper, arlinsandbulte: HTTP_HOST header cannot be trusted