SECURITY: fix SMTP verb option parsing