don not allow urls
sanity?