Seems to rely on forcing the user to make a request with an arbitrary "host" header. Can you do that from javascript or some other webpage embeddable thingy? If

Seems to rely on forcing the user to make a request with an arbitrary "host" header. Can you do that from javascript or some other webpage embeddable thingy? If you can't then it's not such a big problem (although obviously it still shouldn't be like that)