Add allowed_hosts to production config