Add new ALLOWED_HOSTS_EXEMPT setting

[Jonas Haag]

This patch adds a new ALLOWED_HOSTS_EXEMPT setting to exclude some URLs from Host header validation.

This can become handy if you can't control the Host header sent to your application but still want to accept the request. An example of this is health checks made by AWS ECS/Fargate – google "django allowed_hosts aws" and find 16,000 results with tips how to work around the problem.

[Jonas Haag]

​https://github.com/django/django/pull/10383

[Simon Charette]

Without weighting in on the acceptability of the feature request the setting name should probably contain _URL to adhere the existing setting names.

[Jonas Haag]

I took SECURE_REDIRECT_EXEMPT as a guideline, both in terms of naming and in terms of implementation

[Simon Charette]

The thing with SECURE_REDIRECT_EXEMPT is that it contains REDIRECT_EXEMPT which kind of self-document that it must contain paths. In the case of ALLOWED_HOSTS_EXEMPT it's not clear that it's a paths exemption list; it sounds like an hosts exemption list.

[Tim Graham]

Proposals to add new settings must be made on the DevelopersMailingList.

[Tim Graham]

The ​django-developers discussion didn't yield a consensus to add this.