$refresh_url should be HTML escaped