Use whitelist for allowed URL schemes.