simplify HostVerifier, also more secure

 * does not allow host because it's in the 'Host' HTTP header
 * faster search via hash map
 * reduce allow hosts to actual hosts