add allowed hosts