URLs are escaped one too many times

& is replaced with & in links