Don't check for href prefix anymore

This doesn't really serve any security purposes at all.

Fix #91
Fix #87
Bringing back the testcase for #49
Make test_list stricter