Fix the tests that were failing after d3de9c0e5d

- This makes sure that at least some XSS vulnerabilities are catered
  for, by checking that the path doesn't contain `<script>`.
  `URI.parse` did this for us, but we don't have the luxury using
  `Addressable::URI.parse`, as it is a valid URL according to the RFC
  it uses - see https://github.com/sporkmonger/addressable/issues/141.
- Underscores are also valid according to `Addressable::URI.parse`,
  so change the tests using underscores for invalid data to use curly
  braces for invalid data. Revert the changes in 30b999a that had to
  change underscores to dashes for `URI.parse` to confirm the
  hostnames as valid.