This uses a different regexp match than above, and doesn't necessarily match the same `cid:` URL—it happens to work because `String#[]=` replaces the first occurrence, and the scanned cids are in order of appearance.