add ALLOWED_HOSTS to cofirm api requests