security fix: encode all htmls-entetirs from URI