* sanitize urlesc, so we don't buffer overrun.