If both :authority and host appear in client initial headers, we either
leak (in opt builds) or crash (in dbg).