Allow allowed_hosts to come from environment

Then shouldn't it be: DJANGO_ALLOWED_HOST? I know it sounds pedantic, but our environment variables that correspond to django settings should match that name so that the mapping is obvious. Maybe it's obvious to y'all.