HMAC identity tests should not hardcode gholak/montzar hosts. Co-authored-by: Cursor <cursoragent@cursor.com>