Use xs_replace_n() where it suits.

http.c

@@ -33,7 +33,7 @@ xs_dict *http_signed_request_raw(const char *keyid, const char *seckey,
     date = xs_str_utctime(0, "%a, %d %b %Y %H:%M:%S GMT");
 
     {
-        xs *s = xs_replace(url, "https:/" "/", "");
+        xs *s = xs_replace_n(url, "https:/" "/", "", 1);
         l1 = xs_split_n(s, "/", 1);
     }
 

mastoapi.c

@@ -185,7 +185,7 @@ int oauth_get_handler(const xs_dict *req, const char *q_path,
 
     int status   = 404;
     xs_dict *msg = xs_dict_get(req, "q_vars");
-    xs *cmd      = xs_replace(q_path, "/oauth", "");
+    xs *cmd      = xs_replace_n(q_path, "/oauth", "", 1);
 
     srv_debug(1, xs_fmt("oauth_get_handler %s", q_path));
 
@@ -245,7 +245,7 @@ int oauth_post_handler(const xs_dict *req, const char *q_path,
     else
         args = xs_dup(xs_dict_get(req, "p_vars"));
 
-    xs *cmd = xs_replace(q_path, "/oauth", "");
+    xs *cmd = xs_replace_n(q_path, "/oauth", "", 1);
 
     srv_debug(1, xs_fmt("oauth_post_handler %s", q_path));
 
@@ -328,7 +328,7 @@ int oauth_post_handler(const xs_dict *req, const char *q_path,
             const char *auhdr = xs_dict_get(req, "authorization");
 
             if (!xs_is_null(auhdr) && xs_startswith(auhdr, "Basic ")) {
-                xs *s1 = xs_replace(auhdr, "Basic ", "");
+                xs *s1 = xs_replace_n(auhdr, "Basic ", "", 1);
                 int size;
                 xs *s2 = xs_base64_dec(s1, &size);
 
@@ -787,7 +787,7 @@ int process_auth_token(snac *snac, const xs_dict *req)
 
     /* if there is an authorization field, try to validate it */
     if (!xs_is_null(v = xs_dict_get(req, "authorization")) && xs_startswith(v, "Bearer ")) {
-        xs *tokid = xs_replace(v, "Bearer ", "");
+        xs *tokid = xs_replace_n(v, "Bearer ", "", 1);
         xs *token = token_get(tokid);
 
         if (token != NULL) {
@@ -826,7 +826,7 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
 
     int status    = 404;
     xs_dict *args = xs_dict_get(req, "q_vars");
-    xs *cmd       = xs_replace(q_path, "/api", "");
+    xs *cmd       = xs_replace_n(q_path, "/api", "", 1);
 
     snac snac1 = {0};
     int logged_in = process_auth_token(&snac1, req);
@@ -1500,7 +1500,7 @@ int mastoapi_post_handler(const xs_dict *req, const char *q_path,
         printf("%s\n", j);
     }*/
 
-    xs *cmd = xs_replace(q_path, "/api", "");
+    xs *cmd = xs_replace_n(q_path, "/api", "", 1);
 
     snac snac = {0};
     int logged_in = process_auth_token(&snac, req);
@@ -1916,7 +1916,7 @@ int mastoapi_put_handler(const xs_dict *req, const char *q_path,
     if (args == NULL)
         return 400;
 
-    xs *cmd = xs_replace(q_path, "/api", "");
+    xs *cmd = xs_replace_n(q_path, "/api", "", 1);
 
     snac snac = {0};
     int logged_in = process_auth_token(&snac, req);

webfinger.c

@@ -21,7 +21,7 @@ int webfinger_request(const char *qs, char **actor, char **user)
 
     if (xs_startswith(qs, "https:/" "/")) {
         /* actor query: pick the host */
-        xs *s = xs_replace(qs, "https:/" "/", "");
+        xs *s = xs_replace_n(qs, "https:/" "/", "", 1);
 
         l = xs_split_n(s, "/", 1);
 
@@ -74,7 +74,7 @@ int webfinger_request(const char *qs, char **actor, char **user)
             char *subject = xs_dict_get(obj, "subject");
 
             if (subject)
-                *user = xs_replace(subject, "acct:", "");
+                *user = xs_replace_n(subject, "acct:", "", 1);
         }
 
         if (actor != NULL) {
@@ -136,7 +136,7 @@ int webfinger_get_handler(d_char *req, char *q_path,
     else
     if (xs_startswith(resource, "acct:")) {
         /* it's an account name */
-        xs *an = xs_replace(resource, "acct:", "");
+        xs *an = xs_replace_n(resource, "acct:", "", 1);
         xs *l = NULL;
 
         /* strip a possible leading @ */