Sanitize URL in preview

Make sure oneboxes don't allow XSS injection that would impact security