Don't overwrite href/src attribute under certain conditions
Use security context to resolve pages/files from the requested URL