Thanks, would you know how to enforce the allowed hosts in such a config, a non-JSON version? (see "Host not allowed" when calling the API remotely for the problem and solution for the JSON one, I think that it is even you who marked that as a solution)