add: url (allow|deny) list, block image