Add allowed hosts to postinstall
Ensure that the app view gets a csrf cookie