allow app:// and resource:// urls in front- and backend; add tests