feat(allowed-hosts): make allowed_hosts configurable via env vars