fix escaping of /f/ file URLs

Potential security issue.