allow main site hostnames