Add a config option for allowed host headers