Hm, the Django code more or less trusts the Host header (https://github.com/django/django/blob/master/django/middleware/csrf.py#L156) what's the difference between Django and Warehouse here that makes it unsafe to trust here?