FORCE_DOMAIN might also be empty, and HTTP_HOST not set (esp. under SSL)