Has anything relating to those files changed between jessie and stretch to affect cups being blocked? Would a line in the allow file ALL: localhost:631 help or is the syntax incorrect?