host www.o.o on narwal* (except /openid/)
    
    /openid/ needs to be handled by another server - that's something we'll
    have to configure in haproxy