spec to check for default allowed_hosts