openssh 6.3 regex injection vectors:  inject into ruser and/or exploiting pre-specified limits set for user provided data

resolution -- non-greedy matching prior ```<HOST>``` + removing length limits