Disable arbitrary import URLs for now - don't expect anyone to use them, so we may as well keep the attack surface smaller