required ALLOWED_HOSTS when running as a production server