Do not modify frozen string

bnc#906694
I think this is the wrong way to fix it. APIs should be free to return frozen strings. Whoever needs a modifiable string should `dup` it themselves.