only allow arrays of strings for allowed_hosts