fix tests + make them pass

Failing to split the ALLOWED_{HOSTS,OWNERS} on whitespace means that
we're using the string `in` (which is just a substring check).

So `ithub.com in github.com` evaluates to true, which is a security
issue and most definitely not what we want.

Solution: use .split() (which splits on whitespace by default) so that
we use `in` in a list context, which means 'is this element in the
list'. ugh, python.