marking urls as safe html