fix #3589 using the proposed tactic.

(Aside: Note that the CJSON::decode() is still not so sophisticated that it checks the legality of the Unicode characters in the Unicode strings in the input: some illegal stuff *may* slip through that way. For when you feel like being extra nasty...)