fix up serverspecs which have been dormant for a while

tor tests still not working
Gotcha - differences between prod and staging such as this one should be commented or documented (ideally both), especially when they involve important security boundaries. Helps other developers and auditors avoid "wat" moments :)