add icon to link_to, watch out xss attack