mark javascript links as unsafe