The single write-time validator for host allow/deny entries (#1905). Matching stays in crate::net; this only decides what may be STORED.
crate::net