in multi-site do you set base url for each sites settings?
To be more secure you should set the base url for each site, yes. 

Setting this helps protect against a phishing attack where a malicious user manipulates Drupal's use of the host request header to make the site provide incorrect links.