limit allowed hosts