always include localhost in ALLOWED_HOST list for now