"WHO <hostmask>": use displayed hostname for matching

Use the currently "displayed hostname" (which can be cloaked!) for
hostname matching, not the real one. In other words: don't display
all the cloaked users on a specific real hostname!

Thanks to DNS <dns@rbose.org> for reporting this issue.