re-enabled host matching for callback urls as the bug is fixed at another place now