Allowed hosts

Also written: allowedHosts, NG_ALLOWED_HOSTS

The list of host names a production SSR server will answer. It's set in `angular.json` or the `NG_ALLOWED_HOSTS` environment variable, and other hosts get a 400 error, which blocks forged-host attacks.