modify tests to use configurable url decoration
XSS protection by doing input validation before persisting