Fix #936/CVE-2009-0417: Cross-site scripting vulnerability in handling of incoming URLs
fix comment, refs #936
merge 3a51455eb91f1ae1c18ff235a6f097e77b1ac961 to 09543899c77f88d7f70083a577df368bd341329f (from 0.11), refs #936