middleware: tolerate null allowed_hosts setting.