the allowlist that starts empty
One server process serves several scopes: the public storefront, the marketplace, the authentication pages, the staff tools. Each had a host check — the request must arrive addressed to exactly the host this deployment serves. Strict,…