Always check X-Forwarded-Host when getting the app's hostname.