Pin repoze.who-testutil to 1.0

Otherwise 1.0.1 might be pulled in, which isn't compatible with
repoze.who = 2.0.