miscounting when parsing versions cell

  const uint8_t *cp, *end;
...
  for (cp = cell->payload; cp+1 < end; ++cp) {
    uint16_t v = ntohs(get_uint16(cp));

So we count the payload one byte at a time, considering that byte plus the one after it?

The payload in a VERSIONS cell is a series of big-endian two-byte
   integers.

That probably produces some weird behavior. Marking as 0.2.3 since I'm not sure yet what weird behavior.

Reported by bob from irc.