They should not allow this. At the very least, the actual and the displayed url need to be on the same domain, and preferably the displayed url needs to be a su

They should not allow this. At the very least, the actual and the displayed url need to be on the same domain, and preferably the displayed url needs to be a substring of the actual url. That way they can still pass parameters for all sorts of statistics.