default trusted_hosts to nil.