Make allowed hosts configurable at least in dev mode

[Oaphi]

Currently, we hardcode the list of allowed hosts in development:

config.hosts << /[a-z0-9\-.]+\.ngrok-free\.app/

This is fine, but we could facilitate local development setups by providing an environment variable that can be used to add more allowed hosts. This is useful when a setup is uses local DNS to have proper domains in development (which, in turn, is useful for setting up self-signed SSL certs).