ensures that href attrs arent escaped