res_http_websocket: Avoid reading past end of string