Vhost request for apps might expose locally running servers or other website data

[csoni111]

Currently one can access any local server running on the hda machine using Vhost/? in User-Agent header, for example Vhost/localhost:3000/blah-blah or even more vulnerable could be Vhost/anywebsite.com.