validate a document only when its license URL is in a limited set, fixes #130