added herokuapp.com to allowed hosts