Don't default to localhost for allowed