Parse the 'to' address as if on a real mail to trigger quoted string encoding.
 Replace backticks with call to exec(), the former spawns a new process, and the latter replaces the current process. In the daemon context we care about the process id so that calls to startstopdaemon won't spawn a new daemon.
For non-HTML requests, just return the response code for now.
Handle json requests for hidden info requests.