[vhost-]

Also, if you can swing https://washingtonpost.com?page=securedrop, the request will just look like it's to https://washingtonpost.com since query parameters are encrypted with ssl.

[improv32]

So is the rest of the URL, it could just as well be https://washingtonpost.com/securedrop

[vhost-]

Oh right, paths are too. Sorry!