This only works because the same company is hosting the content (appspot) as the fronting domain (google.com). Google terminates the TLS then looks at the host header to see where to send it.

I couldn't hide my website behind facebook, because my website and facebook are not behind the same TLS terminator.