Employ .attr("href", "<url>") instead of $("<a href='" + url  + "'>")

We should use .attr() as a matter of best practice to play it safe against weird corner cases where the urls passed on to goTo() are malformed by stray single-quotes <<'>>.

With the new approach the resulting error should be way more clear.