why we use `uri.host` only for privileged app?