You need to specify the expected host in the config somewhere. It's not appropriate to trust the host header.