add ALLOWED_HOSTS in setting