Fix #1019/CVE-2009-0417: Cross-site scripting vulnerability in handling of incoming URLs
fix comment, refs #1019
merge e8445f77ca02754ba48df17b78390e0f764eb977...3839eb36cb35b58b3e7726585ceec14d31809753 (from 0.11), refs #1019