Verify inputs to PAC resolving.

This verifies both the URL and host are valid before they are passed to the
javascript for PAC.  This is to protect against injection attacks.

Bug: 10230771
Change-Id: Ib1996181971a49ccd390f181ec3848124801e4d5