live setting for allowed_hosts