fix security xss issue#10

It was a simple patch.  I added the test case for it too.  I was tempted to escape "=" characters too, but those are valid within links so it would have been tricky to escape them properly without causing problems with handling links.  

This version is ready for release, it seems that all the youtube changes are working as expected in this commit.