server_name is only validated as string in the ACP server settings and the installer, so it can be saved empty. If both server_name and cookie_domain are empty, session::extract_current_hostname() falls back to the request Host header. Generated URLs, including those in emails, then depend on a client-supplied value.

Make server_name a required, non-empty setting in acp_board (server settings) and in the installer’s server data step.