installation: make sure URLs are escaped