There is a very slight breaking change in the sense that the host header
check is grouped with its normalization which swaps its order with the
PRI method check.

In practice that only means that if you have both an unattended PRI
request missing a host header, you'll get a 400 instead of a 405. You
have to get both wrong in the first place so I don't consider this a
concern.