Fix Unsanitized Server Variables

Fix unsanitized server variables in `UrlHelper`