protecting against uri's without scheme