yeah I agree this might even be a security problem when we take the host header directly? can we just stick with the raw path?