allow only fully qualified URLs