Disallow javascript protocol in IFrameURL using a whitelist of allowed schemes. Includes unit testing