Fix #449: edge case in normalize_link.

src/tools.cpp:
When the iterator points to '%', we need to check that there
are 2 valid characters before the null terminator. Since
string::end() points to the null terminator of the underlying
c-string:

['%','A','B','\0']
  ^
p:0   1   2   3

p+2:      ^

test/tools-test.cpp:
* Change expect to assert now that all tests are passing

src/tools.cpp

@@ -450,8 +450,10 @@ std::string normalize_link(const std::string& input, const std::string& baseUrl)
 
         if ( *p == '%')
         {
-            if( (p+3) >= input.cend()){
+            if( (p+2) >= input.cend()){
                 // if the %XX token would go off the end of the string, just break
+                // string::end() returns an iterator pointing to the null terminator
+                // of the underlying c-string (guarenteed as of C++11)
                 break;
             }
             // hhx only officially supports hex unsigned char

test/tools-test.cpp

@@ -260,8 +260,8 @@ TEST(tools, normalize_link)
     ASSERT_EQ(normalize_link("%", "/"), "/");
     ASSERT_EQ(normalize_link("%1", ""), "");
 
-    EXPECT_EQ(normalize_link("%26", ""), "&");
-    EXPECT_EQ(normalize_link("%27", "/"), "/\'");
+    ASSERT_EQ(normalize_link("%26", ""), "&");
+    ASSERT_EQ(normalize_link("%27", "/"), "/\'");
 
     // ../test/tools-test.cpp:260: Failure
     // Expected equality of these values: