add allowed_hosts