Made `is_safe_url` overridable (closes #785)