[general] pass embedURL through MIME type checker
[general] better whitelist messages