set allowed hosts