made checking for allowed_urls from database more generic