BF: Tags not fully recursively substituted

Note: recursive check ignored for "matches", as tags would be escaped,
and hence shouldn't match `<%s>` as `<ip>` would become `\<ip\>`. This
therefore maintains advantage of delayed call for {ip,jail,}matches.

Fixes gh-713