adds : separated allowed hosts to settings via env