Sanity-check public_url on each incoming request.

This logs an up-front warning if the `public_url` setting does not match what the app thinks is its public URL.  Such a condition will almost certainly produce a cryptic authentication error so this will give the user a bit more guidance as to the source of the problem.

@callahad r?