It turns out that we accept events with non-ascii IDs, which would later cause
an explosion during state res.

Fixes #4226