added allow-hosts; fixed plone.app.testing version