stricter validation, http/s protocols only, rejecting empty domains