ref(controller): remove redundant ALLOWED_HOSTS setting