[Aetae]

UAs MUST set the Host header appropriately (see open()) and not allow it to be overridden.

The setRequestHeader(header, value) method must run these steps:
1. If the state is not OPENED, throw an "InvalidStateError" exception.
...
5. Terminate these steps if header is a case-insensitive match for one of the following headers:
- Accept-Charset
...
- Host
...

Так что только серверсайд.