An HTTP/3 listener works for browsers and breaks signed backend auth

The host header seems unchanged in logs, yet the h3 path normalizes authority differently before the upstream request is signed.