The PHP documentation states that $_SERVER['HTTP_HOST'] is:
Contents of the Host: header from the current request, if there is one.
Indeed, every variable in this associative array whose key begins with the string HTTP_ is a copy of the corresponding HTTP request variable sent by the user agent.
So, why does it sometimes contain the hostname, and ...
Let's go through it:
Your first rule essentially sets HTTP:Authorization, which is something strange peculiar for your setup but not unusual...importantly, there is no [L]
Second rule says that when you REQUEST_URI that ends in a / but which is not a directory, you grab just that file. IF it matches though, you redirect externally, and we're back to the ...