allowed hosts should be hosts, not urls