urlparse raises ValueError on bracketed authorities like "http://[::1" or
"https://[not-an-ip]:80". Three user-input boundaries let that escape:
the WebSocket Origin guard, /api/media/proxy and the custom-endpoint
base_url save, turning a bad header/param into an unhandled 500 instead of
a clean rejection. Fail closed there: 4403 origin_mismatch for the WS
guard, HTTP 400 for the two routes.
Salvaged from #131323 (net diff; the interim loopback-origin exemption the
PR added and then removed is squashed out).
8a0dfcf29f