web server now checks both :authority and host headers