[html] Sanitize value used to construct url r=paranoia