Don't Trust the Host Header for Sending Password Reset Emails
lightningsecurity.io