Whether we are serving a real, resolved host rather than the default. Gates HTTPS-only behaviour — Secure/__Host- cookies and the HSTS header — which must stay off for local development on DEFAULT_DOMAIN.