Extra escaping on layered nav href to prevent injection