diff --git a/www/code/inner.js b/www/code/inner.js
index 4798e24c5..fad828fa6 100644
--- a/www/code/inner.js
+++ b/www/code/inner.js
@@ -125,7 +125,7 @@ define([
                 e.preventDefault();
                 var $a = $t.is('a') ? $t : $t.parents('a').first();
                 var href = $a.attr('href');
-                window.open(href);
+                framework._.sfCommon.openUnsafeURL(href);
             }
         });
 
diff --git a/www/common/common-ui-elements.js b/www/common/common-ui-elements.js
index a6d680e7f..32b89c424 100644
--- a/www/common/common-ui-elements.js
+++ b/www/common/common-ui-elements.js
@@ -261,7 +261,7 @@ define([
         return button;
     };
 
-    var createMdToolbar = function (editor) {
+    var createMdToolbar = function (common, editor) {
         var $toolbar = $('<div>', {
             'class': 'cp-markdown-toolbar'
         });
@@ -359,13 +359,12 @@ define([
             title: Messages.mdToolbar_help
         }).click(function () {
             var href = Messages.mdToolbar_tutorial;
-            var bounceHref = window.location.origin + '/bounce/#' + encodeURIComponent(href);
-            window.open(bounceHref);
+            common.openUnsafeURL(href);
         }).appendTo($toolbar);
         return $toolbar;
     };
     UIElements.createMarkdownToolbar = function (common, editor) {
-        var $toolbar = createMdToolbar(editor);
+        var $toolbar = createMdToolbar(common, editor);
         var cfg = {
             title: Messages.mdToolbar_button,
             element: $toolbar
diff --git a/www/common/sframe-common.js b/www/common/sframe-common.js
index af889753e..f50ff71da 100644
--- a/www/common/sframe-common.js
+++ b/www/common/sframe-common.js
@@ -299,6 +299,10 @@ define([
 
     funcs.gotoURL = function (url) { ctx.sframeChan.event('EV_GOTO_URL', url); };
     funcs.openURL = function (url) { ctx.sframeChan.event('EV_OPEN_URL', url); };
+    funcs.openUnsafeURL = function (url) {
+        var bounceHref = window.location.origin + '/bounce/#' + encodeURIComponent(url);
+        window.open(bounceHref);
+    };
 
     funcs.whenRealtimeSyncs = evRealtimeSynced.reg;
 
diff --git a/www/contacts/messenger-ui.js b/www/contacts/messenger-ui.js
index 988e74f43..3847579b9 100644
--- a/www/contacts/messenger-ui.js
+++ b/www/contacts/messenger-ui.js
@@ -1,6 +1,5 @@
 define([
     'jquery',
-    '/common/cryptpad-common.js',
     '/customize/messages.js',
     '/common/common-util.js',
     '/common/common-interface.js',
@@ -8,36 +7,11 @@ define([
     '/common/hyperscript.js',
     '/bower_components/marked/marked.min.js',
     '/common/media-tag.js',
-], function ($, Cryptpad, Messages, Util, UI, Notifier, h, Marked, MediaTag) {
+], function ($, Messages, Util, UI, Notifier, h, Marked, MediaTag) {
     'use strict';
 
     var MessengerUI = {};
 
-    var m = function (md) {
-        var d = h('div.cp-app-contacts-content');
-        try {
-            d.innerHTML = Marked(md || '');
-            var $d = $(d);
-            // remove potentially malicious elements
-            $d.find('script, iframe, object, applet, video, audio').remove();
-
-            // override link clicking, because we're in an iframe
-            $d.find('a').each(function () {
-                var href = $(this).click(function (e) {
-                    e.preventDefault();
-                    window.open(href);
-                }).attr('href');
-            });
-
-            // activate media-tags
-            $d.find('media-tag').each(function (i, e) { MediaTag(e); });
-        } catch (e) {
-            console.error(md);
-            console.error(e);
-        }
-        return d;
-    };
-
     var dataQuery = function (curvePublic) {
         return '[data-key="' + curvePublic + '"]';
     };
@@ -81,6 +55,31 @@ define([
             find.inList(curvePublic).removeClass('cp-app-contacts-notify');
         };
 
+        var m = function (md) {
+            var d = h('div.cp-app-contacts-content');
+            try {
+                d.innerHTML = Marked(md || '');
+                var $d = $(d);
+                // remove potentially malicious elements
+                $d.find('script, iframe, object, applet, video, audio').remove();
+
+                // override link clicking, because we're in an iframe
+                $d.find('a').each(function () {
+                    var href = $(this).click(function (e) {
+                        e.preventDefault();
+                        common.openUnsafeURL(href);
+                    }).attr('href');
+                });
+
+                // activate media-tags
+                $d.find('media-tag').each(function (i, e) { MediaTag(e); });
+            } catch (e) {
+                console.error(md);
+                console.error(e);
+            }
+            return d;
+        };
+
         var markup = {};
         markup.message = function (msg) {
             var curvePublic = msg.author;
@@ -510,7 +509,7 @@ define([
             console.error('TODO show something if that chatbox was active');
         });
 
-        Cryptpad.onDisplayNameChanged(function () {
+        common.getMetadataMgr().onChange(function () {
             //messenger.checkNewFriends();
             messenger.updateMyData();
         });
diff --git a/www/pad/inner.js b/www/pad/inner.js
index c2b68f5ef..ee4e7f58d 100644
--- a/www/pad/inner.js
+++ b/www/pad/inner.js
@@ -345,8 +345,9 @@ define([
             var el = e.currentTarget;
             if (!el || el.nodeName !== 'A') { return; }
             var href = el.getAttribute('href');
-            var bounceHref = window.location.origin + '/bounce/#' + encodeURIComponent(href);
-            if (href) { ifrWindow.open(bounceHref, '_blank'); }
+            if (href) {
+                framework._.sfCommon.openUnsafeURL(href);
+            }
         };
 
         framework.onEditableChange(function (unlocked) {
diff --git a/www/poll/inner.js b/www/poll/inner.js
index c1799e663..b8af07890 100644
--- a/www/poll/inner.js
+++ b/www/poll/inner.js
@@ -1206,7 +1206,7 @@ define([
                     var $a = $t.is('a') ? $t : $t.parents('a').first();
                     var href = $a.attr('href');
                     if (!href) { return; }
-                    window.open(href);
+                    common.openUnsafeURL(href);
                 }
             });
 
diff --git a/www/slide/inner.js b/www/slide/inner.js
index 280d8481c..37c284d72 100644
--- a/www/slide/inner.js
+++ b/www/slide/inner.js
@@ -358,7 +358,7 @@ define([
         });
     };
 
-    var activateLinks = function ($content) {
+    var activateLinks = function ($content, framework) {
         $content.click(function (e) {
             if (!e.target) { return; }
             var $t = $(e.target);
@@ -366,7 +366,7 @@ define([
                 e.preventDefault();
                 var $a = $t.is('a') ? $t : $t.parents('a').first();
                 var href = $a.attr('href');
-                window.open(href);
+                framework._.sfCommon.openUnsafeURL(href);
             }
         });
     };
@@ -389,7 +389,7 @@ define([
 
         var $toolbarDrawer = framework._.toolbar.$drawer;
 
-        activateLinks($content);
+        activateLinks($content, framework);
         Slide.setModal(framework._.sfCommon, $modal, $content, slideOptions, Messages.slideInitialState);
         mkPrintButton(framework, editor, $content, $print, $toolbarDrawer);
         mkSlideOptionsButton(framework, slideOptions, $toolbarDrawer);