whitelist app:/ protocol or angular labels it 'unsafe'