z_html: escape & sanitize url/uri properties.