allowed_hosts setting is now required in production