ALLOWED_HOSTS must always be '*'