web/download: open external links with noopener,noreferrer