A malicious IRCd could send a WHO reply for a nick which consisted completely
out of prefix characters (thus an empty nick). In this case
std::string::find_first_of() would return std::string::npos. This argument would
make std::string::substr() throw an exception and kill the process.
Signed-off-by: Uli Schlachter <psychon@znc.in>