Include /^http… prefix in onebox whitelist URLs regexes to prevent XSS.
Be more selective about when we allow oembed discovery
Allow oneboxers to specify their simple_onebox text is unsafe
Merge branch 'onebox-safety' of git://github.com/tms/discourse
Remove leftover sub-tag support.