Correct escaping of URIs in `messageSanitize`

For example, this fixes things like `google [&amp;]` which would
previously produce the wrong Google search query.