add host/path allow/deny