allow only relative urls