is it necessary to keep the "orginalHost" around? can't we just check the current host against the redirect url host before we do the forward and remove the authorization.