Verify that it's a file URL

... and only show the permission pase in those cases.

(Theoretically, executeScript() might fail for other cases,
too, even if we have never seen any cases for that.)