Escape stylesheet urls

Urls need to be escaped, as the constant cannot be entirely trusted and
$stylesheet could conceivably be anything.