change #link method to escape @url but not & [fixes #166 #174]
fix describe block name and use unescaped link in includes link test
use triple braces for link b/c need to escape it
Merge pull request #179 from dysania/fixing-security-flaw-with-links

Fixing security flaw with links