allow setting a web instance in the url from a whitelist

as web clients can be hosted on multiple domains, allow specifying
which hosted instance we want to use.

as this could be phishing vector, we work with a host whitelist for now
until a better solution comes to mind.