added whitelist of allowable URI schemes