rename "uri" to "url" (clients beware!), be a little more restrictive about accepted URLs