url: Urls containing invalid hostname return blank

Fixes #8520

From the issue:

> url.parse misinterpreted `https://good.com+.evil.org/` as `https://good.com/+.evil.org/`
If we use url.parse to check the validity of the hostname, the test passes, but in the browser the user is redirected to the evil.org website.