naughtyHref must entity-decode URLs and also check for mixed-case scheme names. Thanks to pinpickle. Closes #1