require allow-uri-read attribute to be set for including content from a uri