fix allowed hosts again