Enforce max filesize, allow URLs without protocol