Sanitize shell domain names. Fixes #1.

This doesn't use shell-escape, because even though that lib makes
commands suitable for running in a shell oneself, like bash, node's
exec() function was not evaluating the $-escaped text the way an
actual shell would.

So, this does a very strict sanitization process, where only word
chars, digits, and dots make it through. I will adjust as needed.