taint SNI values supplied by client