use an array for allowed hosts