I'm confused why you're talking several times about "relative URLs" here. A URL starting with "javascript:" isn't a valid relative URL, so if you escape things properly to ensure that you're always generating a valid relative URL, you should be fine even if people name their Things maliciously. If a URL starts with an alphanumeric (plus + . and -) string followed by a colon, that's interpreted as a scheme; you can fix that by prepending "./" to the start of your relative URL or (in most cases) URL-escaping the :.