Add ALLOWED_HOSTS to production settings