fixed URL sanitization