constraint protocols to http, https and data

For #18
Not a complete solution, but addresses the most important cases.