Escape the final redirect url

and added a test for the `clean_and_validate()` function

see https://github.com/GigaOM/gigaom/issues/4854