implement --allowed-hosts flag

[velzie]

The --allowed-hosts flag allows users to block requests with Host headers that aren't whitelisted, preventing against DNS rebinding attacks

Relevant issues

Fixes #758

Contributor checklist

• Provide tests for the changes (unless documentation-only)
• Documented any new features, CLI switches, etc. (if applicable)
  • Server --help output
  • README.md
  • doc/http-server.1 (use the same format as other entries)
• The pull request is being made against the master branch

Maintainer checklist

• Assign a version triage tag
• Approve tests if applicable

[velzie]

We might want to add more validation to the argument - I can see users passing in something like --allowed-hosts=localhost:8080 which would break, but maybe we should leave that until the options refactor