Prevent window.open() from loading untrusted web content

As discussed recently... Prevent extensions from using `window.open()` as a quick way to show the user general, untrusted web content. Throw exception pointing out the 'right' safe API to use. Still allows file: URLs and relative paths (which are by definition file: too, and used by Debug > Run Tests).