libs/web: stricter validation in build_url(), prevents some XSS