prevent tampering with host, port, protocol

Prevents :host, :port, :protocol settings get inherited from GET query
parameters.

Fixes #285