0.1.6: security improvement: reject URLs that are not http: or https: completely right up front