don't use settings.local unless they specify it and fix up ALLOWED_HOSTS