host checked, bad request returned if not same