more specific URL regexp

Prevents embedding files that don't end in \.pdf
also prevents embedding files from home_url(). '.reallybadsite.com/malicious.pdf'