fix url escaping for xss bullshit