Fix #1649

This fixes the test for #1649. I don't believe the escaping is necessary on the href attribute, because the URL is coming from a trusted source.
This seems kind of a risky assumption?