URL-pattern check can't be strict because of custom callback schemes for native apps