sanitize is now only used on urls before checking them against legal service urls etc
removed php closing tags to avoid spurious blank lines