sanitization: restore missed href attr into a tag