escape urls passed into action handlers