make ALLOWED_HOSTS customizable through environment variables