removed local bootrap.js link
added '_' to allowed url characters