Ticket 405 had an almost-exploit enabled by sloppy assignment of
strlen().  There were more details involved, of course, but this
served as encouragement to clean up obvious "strlen assignment to int"
in the rest of the code.

Note this is not *all* cases, only those that were simple and obvious.
In some cases, the code assigns strlen() to an int but also uses that
variable to hold negative values for another reason.  In other cases,
an API is involved (e.g. SASL) that make changing potentially
dangerous.  And lastly, some functions were just a bit too complicated
to risk introducing a bug.