util: generalize is_localhost() and use it everywhere where applicable
util: when unescaping strings, don't allow smuggling in of additional NUL bytes

Better safe than sorry.