curl: fix security problems