Rename allowed_domains and disable all by default

[radu-matei]

First of all, allowed_domains should actually be allowed_hosts, because the items can be IP addresses, not only domain names.

But more importantly, when passing None, the library currently allows guest modules to make requests to any server, which is counter-intuitive, and directly opposed to how any other capability works.

We should address both of these and release a new version to crates.io.