properly set ALLOWED_HOSTS for production and local development