whitelist known non-host uri schemes, see #447