fix protocol checking in sanitization [CVE-2013-1857]

Rails-patch mondays!

cc: https://github.com/github/security/issues/113