MDL-38431 comment: profile url should be escaped, as it's used in html