only allow access via specific http hostname