Expand AllowedHosts testing: include wildcard, IP range