Forbid javascript:// URLs in safe mode
Merge pull request #185 from phihag/safemode-no-javascript-urls

Prevent javascript:// URLs