ALLOWED_HOSTS now read in from env