Allowed hosts without http