Move the AllowedHosts option to a production only state.

It was annoying to have the AllowedHosts take effect in a development environment. I changed the behaviour so this option will only be effective in production.