both variables are either empty or start with a leading / per the spec; also correctly prepend SCRIPT_NAME to the link we generate.