authenticate server via the host header