fixes #6637 - loosening url validation restrictions