return resolved url if url is safe instead of return true (updated test too)