Use 'hostname' instead of 'host', which includes port number.

`url.parse("http://foo.com:444/bar").hostname` returns `"foo.com:444"`,
which causes `validate` to make an invalid call to `https`.

This permits using a CAS running on a different port.