check url safety

Hey !

I added & implement [safe-url-input-checker](https://github.com/w3c/safe-url-input-checker) to check url safety (loopback, private, localhost, blacklisted websites...).
If necessary we can pass a list of acceptable protocols & a blacklist in options. 
tests passed with mocha.

Let me know if you have some questions or comments. :)
* I would split that long line in two or three, maybe after `data.url +`, to avoid ugly line wrapping on some editors/screens.
* Also (and this is thinking out loud), shall we localise these messages for exceptions, too (using `lib/l10n.js`)?