debug = false, add allowed host