Deny access by IP on testing domains
Recursively strip control characters from API JSON input
Allow tags with no linked items in classic sync

Due to a bug in the client, I think, but might as well allow and ignore it.
Don't escape Unicode in JSON output