fix misuse of "| u"

(because I am a derp)

There are definitely further security improvements to be made here
(e.g. avoiding "javascript:" links). I'll send another change to fix
that shortly.