prevent leading combining chars in HTTP inputs