Fix potential self XSS in request url.