protect against non http(s) urls