test the BOM-related check

also tighten up the spec to disallow ctrl chars in prop names