fix stored XSS attack vector, make injected link relative