added heroku url to allowed hosts