Allow data URI schemes, with content type whitelist

Also, use proper URIs in the tests.

Note that the content type whitelist currently only contains 'image/png'; this can be filled out in a separate PR after a more complete discussion about allowable content types.