Make URL sanitation stricter

Summary:
ignores all characters outside of A-Za-z0-9 when checking for a leading
'javascript:' in the URL.

Test Plan:
Made a javascript link in perseus, checked that it was sanitized to '#'