[fix] debug mode disabled by default
[fix] html escape url