The source detail page assigned the raw X-Forwarded-Proto value
straight into the URL scheme, so `HTTPS` rendered `HTTPS://host`,
a chained proxy's `https, http` rendered `https, http://host`, and
any token at all landed there verbatim. That URL is what the
operator pastes into GitHub or Stripe, so a malformed scheme means
the webhook never arrives. A present header also overwrote what a
direct TLS connection had already proved.
The scheme now comes from reqtls.IsTLS, the shared predicate, so it
is only ever http or https and all three TLS-decision sites agree.
The host stays as the request sent it: nothing in the configuration
names a canonical hostname to validate against, and constraining it
would break the deployments behind a proxy on a non-default port or
an IPv6 literal. A comment marks why the unvalidated value is inert
where it is rendered.
