The `strlen()` here may be redundant for the `__construct()` code path, but this makes the function do complete validation on its own. And checking for `NULL` avoids a possible segfault with `strlen()` and `strspn()`.

I realize we have different `__construct()` exceptions for strings that aren't 24 characters and those that are but don't have valid hex characters, and probably need to keep that for BC, but checking length logically belongs in this function, too.