would it be too much to ask to pull each check into it's own function? like:

~~~ go
applyAllowedHosts(opts, res, req)
applySSL(opts, res, req)
applyAllowedSTS(opts, res, req)
...
~~~