tighten OpenID trust regexp even more