Yeah, I wasn't able to think of a good way to remove this duplication. I wanted to put the checks for `params.url` and `allowedHost(...)` into the `ProxiedRequest` class but the `render` method (which we use to send the messages back to the user if there is a problem) wouldn't be available from that class. So we'd have to be doing something like throwing exceptions from ProxiedRequest with the message set which is the message for the user. That solution seemed messier to me than this duplication.