escape urls returned by url_for