Added trusted domain warning if untrusted host used

- do not replace the current host any more but reuse it, even when
  untrusted
- show a warning on the login page inline and as notification in the app
  when an untrusted domain was used

TODOs:
- [x] show warning
- [ ] allow localhost as domain

Please review @karlitschek @LukasReschke @schiesbn