iwildmatch() folded only the text to lower case, not the pattern, so it was
asymmetric rather than case-insensitive. An upper-case "hosts deny" token
(e.g. *.BADDOMAIN.COM) then failed to match a lower-case peer name and the
blocked host was admitted -- an access-control fail-open. Fold the pattern
char too under force_lower_case.
Reported-by: Leonid Bugaev