SNI and Host header mismatch

Currently a `SNI` vs `Host` mismatch is not checked, which allows a client to connect using one domain and then reuse the same connection for another domain. Technically this should be fine/okish if the server is authoritative for both domains, and in fact some clients seem to do this reusing. However, it still might be a rather surprising feature.