Latte: safeUrl allows colon when URL starts with / ? #  [Closes #1389]