Catch 'jav\tascript:alert("XSS")' as a bad URL

The URL checker from html5lib was used as inspiration. As html5lib is
based on the same ideas that browsers (should) use for parsing and
checking, this solution should be much more robust.