strict url validation