Change CAS to only apply to production
Add HostsController spec