fix #253

Note:
The real issue is that there are characters that CANNOT appear as
themselves in URL links, such as # and &. But these should be able
appear in things like tags. The solution is to encode these characters.
BUT, that means that some character sequences are then "reserved". We
have chosen to use "__dd__" encodings. "dd" is the hex code for the
forbidden character. So, these extended sequences are now blacklisted.
Should not cause a problem as they are unlikely sequences, but a point
to be remembered.