Always allow window.location data URLs