URLs must be escaped inside XML, e.g. inside the <link> container, too.