SECURITY: fix XSS in link's href