Limit allowed_url to TIMJ only