Open up ALLOWED_HOSTS by default

This is going to trip up new users otherwise. We aren't doing redirects
or logins anywhere (yet) so it shouldn't be an issue security-wise.