Rework fix; this seems to work better in my tests

Prevents an XSS on the URL being requested, which is rebuilt and echoed
in a couple places