resolves #445 allow include macro to retrieve data from uri

To be secure by default, the `allow-uri-read` attribute must be set in the API or CLI (not document) for this feature to be enabled. It's also completely disabled if the safe mode is SECURE or greater.