SERVER_NAME is safer than HTTP_HOST