fix allowed hosts, fix datetime.today call