move sanitation of urls to the serverside code to also provide security for clients, fix #151
changelog change