Added note about using * in allowed hosts