Azure App Service applicationHost.config Set server variable is working but not working

We are trying to rewrite the "host" header given a header of "X-CF-ORIGIN" - this works locally, however, in the app service, all logging indicates it has worked but we don't seem to see the effect.

We expect to get a 500 error for an incorrect HOST header, however, the site resolves as if the host header has not been changed.

Also, our XDT transform indicates it has worked (see below).

This was initially raised on Kudu Github but have been directed to here for Azure App Service IIS questions.

A code example: https://github.com/Workshop2/webforms-host-header-rewrite-spike

Live example: http://webforms-fun.azurewebsites.net/ with XDT transform

Our rewrite rule:

<rule name="CDN Host Header Rewrite" stopProcessing="false">
  <match url=".*" />
  <conditions logicalGrouping="MatchAll" trackAllCaptures="true">
    <add input="{HTTP_X_CF_ORIGIN}" pattern="(.+)" />
  </conditions>
  <serverVariables>
    <set name="HTTP_HOST" value="{C:1}" />
  </serverVariables>    
  <action type="None" />
</rule>

Our XDT Transform:

<?xml version="1.0"?> 
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform"> 
    <system.webServer> 
        <rewrite>
            <allowedServerVariables>
            <add name="HTTP_HOST" xdt:Transform="InsertIfMissing" />
            </allowedServerVariables>
        </rewrite>
    </system.webServer>
</configuration>

applicationHost (found via IIS Manager):

<rewrite>
  <allowedServerVariables>
    <add name="HTTP_HOST" />
  </allowedServerVariables>
  <globalRules />
  <outboundRules />
  <providers />
  <rewriteMaps />
  <rules />
</rewrite>

Failed Request Tracking:

Testing

If I create a test rule to prove the HTTP_HOST is being altered, it correctly uses the HTTP_HOST data set via the X-CF-ORIGIN header:

<rule name="test" stopProcessing="true">
  <match url=".*" />
  <conditions logicalGrouping="MatchAll" trackAllCaptures="true">
    <add input="{HTTP_X_CF_ORIGIN}" pattern=".+" />
    <add input="{HTTP_HOST}" pattern="(.+)" />
  </conditions>
  <action type="Redirect" url="http://some-site.com/{C:1}" redirectType="Temporary" />
</rule>

Please help - what have we missed?