Integrated into release/v3.8.41. Accepts direct LAN/loopback-IP host as a valid mutation origin (#5340); origin trust gated on the server-stamped peer, not the spoofable Host. 6 security-boundary tests incl. DNS-rebinding.