--allowed-schemes options; disallow most schemes by default.
cleanup: better names and comments in test_request_filters