Move track_legacy_host up to get lazy-parsed Req.

The old Req contains a socket that's been consumed, but the data from it
is in Req2.