In reply to Jeffrey.

It doesn't work that way, as folks can also use the returned url in a Location header or the like, that would not accept a HTML escaped version.

It was a good idea, but we'd already thought it through and sadly no go.