setting ALLOWED_HOSTS in deployment