Add missing env_delim to ALLOWED_HOSTS parameter

[paskal]

Fix for a bug potentially affecting #1139.

Before:

# with ALLOWED_HOSTS=domain1 domain2
# header
Content-Security-Policy: frame-ancestors domain1 domain2;
# with ALLOWED_HOSTS=domain1,domain2
# header
Content-Security-Policy: frame-ancestors domain1,domain2;
# console
Unrecognized Content-Security-Policy directive 'domain2'.

After:

# with ALLOWED_HOSTS=domain1,domain2 or ALLOWED_HOSTS=domain1 domain2
# header
Content-Security-Policy: frame-ancestors domain1 domain2;