0.0.8-1 don't trust req.host - get it from req.headers.host instead