Don't allow unsafe URIs

This fix filter out  link and image URIs like javascript:alert(); that are used for XSS. 
It uses whitelisting and only allows http(s) and ftp URIs.