When str.lower() is a security vulnerability in Python