do we not need to validate the host as well? or should we call it baseurl and allow a path?
what if somebody uses https here? the strncmp will not see it... but will guzzle do anything with this in the end? we give it the scheme and host of the varnish servers, so this one is only used for the HOST header.