Mike's view is that if we receive a request with Route headers like that, we should honour them: but we should only use our "default" target of the upstream proxy for requests over the untrusted port, and reject requests over the trusted port without an explicit target.