some server side fixes for allowed hosts and call to actions