fix allowed host for staging