Add allowed hosts to manifest.json