improve url validation, fix saving leak