get allowed hosts from environment variable