mValidHosts is checked outside of a thread-safe locking