Added sanitize_html and sanitize_url.  These ensure that no non-http /
javascript: urls make it in the description.  The sanitization is very
restrictive.  Only the <a> tag is allowed and only when the href is
an http(s) url.  This is sufficient for our purposes.
Better url escaping.  Python's urlparse and friends are woefully
inadequate.  The current approach isn't great.  I can already see so
many ways of breaking it.  The domain name isn't escaped either.  It
should also be punycoded.  I'm looking for a good existing library.
Much better URL sanitization.  Added the very promising library -
https://github.com/seomoz/url-py.  Unfortunately, they didn't handle
sanitizing the netloc or fragment parts.

  >>> url.parse("http://\"<script>/b\"<b>c?q=\"<script>#bar\"<script>").escape().unicode()
  u'http://"<script>/b%22%3Cb%3Ec?q=%22%3Cscript%3E#bar"<script>'

So I escape everything manually, and then use url.py (renamed to
urlescape.py) for punycode and any other sanitization.