ensure javascript: protocols are not encoded in entities and references.