RFC 6265 disallows IP address domain suffix matches

Forgive me for butting into #354 but I quickly knocked up a PR for this in a bored moment.