allowed hosts production setting