add ALLOWED_HOSTS setting