followup r91869: validate id chars for incoming prefs tabs in hash ([\w-]+ is suffici...