Security wise it makes sense. Easy way around is a prompt, like steam for instance, that shows the real URL with a button to click. Seems backwards not having rich text though.