Prevent javascript:// URLs

This pull request prevents JavaScript URLs and fixes an [XSS attack](http://en.wikipedia.org/wiki/Cross-site_scripting)  that worked even when safe_mode was set.

In the long term, I think it would be certainly a great idea to allow users to lock down the allowed schemes, and default to something sensible, like `http`, `https`, `mailto`, `news` and maybe `tel`.