http-push: don't assume char is signed