Only show DOI and URL links when they are set

Now uses jQuery DOM methods to build the popup, rather than string concatenation, for safety.

Please test before deploying.

fixes #190