My statement was not based on preventing any particular method of attack the HOST header. It more has to do with the general idea that I don't think it is a good idea to trust the incoming request for both pieces of information.