To elaborate the url returned by [Helper::url()](https://github.com/ADmad/cakephp/blob/3.0-formhelper/src/View/Helper.php#L233) is already escaped.