make list of csrf_allowed_hosts configurable

instead of using fixed 127.0.0.1