Development record

A local brief session's relay (abcd session start) refuses any request whose Host header is not the computer's tailnet name or its loopback address, with 421. Which Host header Tailscale Serve passes to the loopback backend was not verified on a live tailnet (the build sandbox could not run the tailscale command), so if Serve sends a form the allowlist does not name, every request through Serve is refused and the session cannot be reached.