We still set a URL to the workitems when lauching a workflow: that dates from before the final release of openwfe we use. Now the definitions can be embedded in the workitem. Fixing this will solve a number of security/virtual hosts/configuration issues.
When doing this we should also remove the appropriate urls from the unsecureUriList.