The `_must not_` part surprised me because open-uri can open file based URIs, e.g. `file:///path/to/file`