Set ALLOWED_HOSTS properly in production

We allow "testserver" due to a trick Asheesh enjoys -- using the
Django test client to make requests from production.