We should put in a note to the effect of "HTTP_HOST comes from the client and is untrustworthy"