add ALLOWED_HOSTS to settings