Include /^http... prefix in onebox whitelist URLs regexes to prevent XSS.
Be more selective about when we allow oembed discovery
Merge pull request #267 from tms/onebox-safety

Tighten up onebox rendering