Also, I replaced a number of tearDown methods with addCleanup instead. And also remove some unneeded patch.stopall() calls.
LMS-9663
Several templates used a variable set by the user (the request host header). This led to a vulnerability where an attacker could inject their domain name into these templates (i.e., activation emails). This patch fixes this vulnerability. LMS-532