Awesome, sorry I wasn't around while you resolved this.

I think this is r+ to get started, but keep in mind:

For security reasons, it's best to send `http://hostname.tld` instead of `hostname.tld`.

Setting `-u` and trusting that is much better than using the request HTTP headers `Host` value, which is user supplied and cannot be trusted.

It sounds like farm does the right thing, but running a single instance over multiple domains has problems.

One possible work around, would be at least match that `req.headers.host` is a substring of your base domain name, to validate this untrusted input. Or to somehow have a list of hostnames that are valid audiences, but this would make for an ugly configuration.