allow whitespace around callback and urls