add configuration value to use a different Host key for CORS checks

jupyterhub/tests/test_api.py

@@ -136,6 +136,32 @@ async def test_cors_checks(app):
     )
     assert r.status_code == 400  # accepted, but invalid
 
+    app.forwarded_host_header = 'X-Forwarded-Host'
+    r = await api_request(
+        app,
+        'users',
+        headers={
+            'Authorization': '',
+            'Referer': url,
+            'Host': host,
+            'X-Forwarded-Host': 'example.com',
+        },
+        cookies=cookies,
+    )
+    assert r.status_code == 403
+
+    r = await api_request(
+        app,
+        'users',
+        headers={
+            'Authorization': '',
+            'Referer': url,
+            'Host': host,
+            'X-Forwarded-Host': host,
+        },
+        cookies=cookies,
+    )
+    assert r.status_code == 200
 
 # --------------
 # User API tests