fixed allowed hosts