curl: fix some security problems