`--check-origin` 绝不能通过 HTTP/2 传递（`check_host_origin` 读取 `WSI_TOKEN_HOST`，而 h2 没有此值）

  char host_buf[256];
  memset(host_buf, 0, sizeof(host_buf));
-  len = lws_hdr_copy(wsi, host_buf, (int)sizeof(host_buf), WSI_TOKEN_HOST);
+  len = 0;
+#if defined(LWS_ROLE_H2)
+  /* HTTP/2 has no Host header; RFC 9113 8.3.1 puts the authority in :authority.
+   * Prefer the pseudo-header: RFC 9113 permits a
…