I'm trying to avoid for users of api to validate url against XSS. But yeah, we should do that at least before DownloadManager