Include host, domain in whitelisted app params

[Finishes #62429184, #62429196]