fix allowed-host security