Sanitize URLs in toUrl

Closes #163