fix host header checking; tighten parseWsUrl