fix allow hosts