added * to allowed hosts