set allowed hosts properly