Returns the host field with whitespace, newlines, and accidental http:// / https:// prefixes stripped.
Some platforms have been observed embedding a stray newline or scheme prefix when reading the local address — sanitising here keeps callers (and the url extension) free of that quirk.