url: Urls containing invalid hostname return blank

Fixes #8520 in v0.10

From the issue:

> url.parse misinterpreted `https://good.com+.evil.org/` as `https://good.com/+.evil.org/`
If we use url.parse to check the validity of the hostname, the test passes, but in the browser the user is redirected to the evil.org website.

This pull takes the approach of returning an empty host(name) field when a hostname part is deemed to contain invalid characters, similar to the way a hostname that is too long is handled currently.