The hosts that the Open Web Calendar permits. This is required to mitigate the Host Header Injection vulnerability. We always set this to the empty list, as Nginx already checks the Host header.

""