Unplug whitelist

Creating for code review.
The only question I see here is what to do when the plugins return `false`.
On `true`: Allow the page to load
On `null`: Allow `file` and `javascript` pages to load
On `false`: ?

I can disallow `file` urls in that case (which is probably a good idea; otherwise, how do you ever block them?) But what about `javascript:`? Should we always allow that? Is it part of the bridge mechanism that could never ever be dropped?