added heroku to the list of allowed hosts