Disable access to unsafe.php for blacklisted hosts.

A better fix that uses an env var is coming in #23.
This is a temporary fix to close the hole.

Fixes #22