ALLOWED_HOSTS default to localhost