limited allowed hosts to base domain and www.