fix memory leak and cleanup

[thz]

• moved json_decref() out of unreachability
• do not return -1 when return value is unsigned
• avoid strtok