routes: skip naive (and potentially buggy) "iv" key check in submitted data
tpl.paste: add warning about shortened url leak