fix allowed hosts