Only support http protocol (security fix, avoid file://)