basic url whitelisting achieved via regex