* Properly validate atproto did:web * explicit why there is no protection against localhost fetches in did:web resolver