the Google Safe Browsing API can take a whole URL, not just a domain name