Sanitize `@` keys to prevent malicious use

Applies to #189

* Add sanitize-html for `@supportURL` and `@homepageURL` parts
* Sanitize those urls using a html stub encasement... only push if exactly equal. e.g. don't show if they aren't
* Create html whitelist link json for this since it's used multiple times
* Change affected view page to accomodate changes

Tested on dev okay but needs testing verification