SECURITY: sanitize markdown urls (prevent XSS)