Use x-forwarded-host header if available

Fixes CORS rewrite when in a proxied environment