moved allowed hosts to top of settings