Image tag URL sanitization, finally