fixes #6589 - add trusted_hosts check back

Indeed, I was just unsure whether it's worse to have code duplicated between smart_proxy (untested, but production) + smart_proxy_for_testing, or across the API classes (which at least we know is always tested).