forcing local links to stay local, despite base target=_blank

also has an essential env.dist fix, because otherwise this will crash and burn the moment you try to publish (remember to set JS allowed in your own .env, too. Bleach is no longer uesd for thimble)