Toxiproxy API access from browser

This was previously "fixed" in PR https://github.com/Shopify/toxiproxy/pull/184, but it looks like it is still possible to access Toxiproxy from a malicious page.

I was looking deeper into this, and the User-Agent header is programmable via JS.
See: https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name

Generally this means a malicious page can make requests from the user's IP. The Host header can't be set, so this isn't terribly useful to an attacker, but there's still definitely DOS possibilities, and issues around unsecured internal endpoints.

I think the main thing that needs to happen is to lock down and verify the hostname requests are being sent to. 127.0.0.1 and localhost should be safe, but we should disallow requests to other hostnames unless explicitly set when starting the service.

CC-ing people on the original PR/issue:
@JackMc @jpittis @sirupsen @EiNSTeiN-

No file or test is named. Trace the browser-facing API and service-startup configuration, then inspect how request hostnames are accepted and validated. Done means browser-originated requests cannot reach non-approved hostnames, while localhost, 127.0.0.1, and explicitly configured hosts remain supported; add coverage for those cases.