fix scope of 'layer hosts deny'; add spec for 'layer hosts add'; fix host id detection logic