cookie-jar: bail if hostname is an empty string (CVE-2018-12910)