A constante _ALLOWED_FORWARDED_HOST define quais hosts HTTP podem figurar legitimamente na variável de servidor HTTP_X_FORWARDED_HOST quando esta for diferente de HTTP_HOST.
Ref:
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Host
- https://search.spip.net/git.spip.net/spip/ecrire/-/blob/bootstrap/proxy.php