fixed STD injection bug for urls, starting with //