Security fix, to prevent "javascript:" in URLs