watch: call get_remote_host during deny() hook

so it shows up in connections that are rejected at hook_connect