This isn't strictly true - we also allow any `*.gov.uk` or `*.mod.uk` subdomain, so a helpful reminder of that here would be nice.

Perhaps we should validate that whitelisted hosts don't end in `.gov.uk` or `.mod.uk` for consistency, so that we don't forget and add them unnecessarily to the list, which would then look confusing.