set allowed_hosts