Add ALLOWED_HOSTS setting.

This must be set, or nothing will work.

Change-Id: I43ad4032dbb8b8ecd63959d76171a80a3a7306fc