making sure we do not allow javsacript: url in either redirects or registrations