Security issues: urlrewrite.xml can be loaded by remote request, not only localhost.

[stujqye]

The doc says:
"You can visit http://127.0.0.1:8080/rewrite-status (or whatever the address of your local webapp and context) to see output (note: this page is only viewable from localhost)."

But if the http request Host field is changed to localhost or 127.0.0.1, the

http://<remote server IP>:<server port>/rewrite-status

can be accessed and show the rewritor configurations.

The request.getServerName() will return the Host field value which can be changed by attacker.