Fix #936/CVE-2009-0417: Cross-site scripting vulnerability in handling of incoming URLs