add allow_hosts for security access