Oh my, this is such a stupid mistake. It went undiscovered only
because I always used CGI scripts on the first vhost (and hence the
offset would be 0) and never on the others.
when we switched from one process to two, I introduced a small
optimisation: empty string are not send, so we receive NULL.
Constructing requri we need to make sure that relpath is not null.
this way, we can sandbox the listener with seccomp (todo) or capsicum
(already done) and still have CGI scripts. When we want to exec, we
tell the executor what to do, the executor executes the scripts and
send the fd backt to the listener.