Original flow. No request was sent.

Browser shows a form.
The form field contains a destination written by the caller.
The backend is the component that would download that destination.
The browser supplied the address. The backend would perform the fetch.

Fictional destination on the worked card: http://desk-metadata.internal/label
That name is not a host to contact. It stands for a service the browser cannot see
and the backend might reach if it fetched caller-supplied addresses.

Activity destinations, also not to be requested:
  http://127.0.0.1:8000/note.txt is on the allowlist card
  http://files.club.internal/note is not on the allowlist card