.../src/Controller/AggregatorController.php        |  1 -
 core/modules/user/src/AccountForm.php              |  1 +
 .../user/src/Form/UserPasswordResetForm.php        |  1 -
 sites/default/default.settings.php                 | 37 ++++++++++++++++++++++
 4 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/core/modules/aggregator/src/Controller/AggregatorController.php b/core/modules/aggregator/src/Controller/AggregatorController.php
index c5fd4e6..b49f3f5 100644
--- a/core/modules/aggregator/src/Controller/AggregatorController.php
+++ b/core/modules/aggregator/src/Controller/AggregatorController.php
@@ -173,7 +173,6 @@ public function adminOverview() {
   public function pageLast() {
     $items = $this->entityManager()->getStorage('aggregator_item')->loadAll(20);
     $build = $this->buildPageList($items);
-
     $build['#attached']['feed'][] = array('aggregator/rss', $this->config('system.site')->get('name') . ' ' . $this->t('aggregator'));
     return $build;
   }
diff --git a/core/modules/user/src/AccountForm.php b/core/modules/user/src/AccountForm.php
index 7ed3cbd..3bb8779 100644
--- a/core/modules/user/src/AccountForm.php
+++ b/core/modules/user/src/AccountForm.php
@@ -74,6 +74,7 @@ public function form(array $form, FormStateInterface $form_state) {
     $account = $this->entity;
     $user = $this->currentUser();
     $config = \Drupal::config('user.settings');
+    $form['#cache']['tags'] = $config->getCacheTags();
 
     $language_interface = \Drupal::languageManager()->getCurrentLanguage();
     $register = $account->isAnonymous();
diff --git a/core/modules/user/src/Form/UserPasswordResetForm.php b/core/modules/user/src/Form/UserPasswordResetForm.php
index 303a21e..f645abb 100644
--- a/core/modules/user/src/Form/UserPasswordResetForm.php
+++ b/core/modules/user/src/Form/UserPasswordResetForm.php
@@ -94,7 +94,6 @@ public function buildForm(array $form, FormStateInterface $form_state, AccountIn
       '#value' => $this->t('Log in'),
     );
 
-    $form['#cache']['tags'] = $this->config('user.settings')->getCacheTags();
     return $form;
   }
 
diff --git a/sites/default/default.settings.php b/sites/default/default.settings.php
index 76d26fc..7cc10be 100644
--- a/sites/default/default.settings.php
+++ b/sites/default/default.settings.php
@@ -607,3 +607,40 @@
 # if (file_exists(__DIR__ . '/settings.local.php')) {
 #   include __DIR__ . '/settings.local.php';
 # }
+
+/**
+ * Trusted host configuration.
+ *
+ * Drupal core can use the Symfony trusted host mechanism to prevent HTTP Host
+ * header spoofing.
+ *
+ * To enable the trusted host mechanism, you enable your allowable hosts
+ * in $settings['trusted_host_patterns']. This should be an array of regular
+ * expression patterns, without delimiters, representing the hosts you would
+ * like to allow.
+ *
+ * For example:
+ * @code
+ * $settings['trusted_host_patterns'] = array(
+ *   '^www\.example\.com$',
+ * );
+ * @endcode
+ * will allow the site to only run from www.example.com.
+ *
+ * If you are running multisite, or if you are running your site from
+ * different domain names (eg, you don't redirect http://www.example.com to
+ * http://example.com), you should specify all of the host patterns that are
+ * allowed by your site.
+ *
+ * For example:
+ * @code
+ * $settings['trusted_host_patterns'] = array(
+ *   '^example\.com$',
+ *   '^.+\.example\.com$',
+ *   '^example\.org',
+ *   '^.+\.example\.org',
+ * );
+ * @endcode
+ * will allow the site to run off of all variants of example.com and
+ * example.org, with all subdomains included.
+ */