document authorized_hosts requirement