Client-side: reject bad hostnames and internal addresses

We should reject connections to things like foo@example.com, or 127.0.0.1, for parity with C tor.