URL check

Also written: safe_url, host_ok

Code that accepts only plain `https` URLs and refuses backslashes, `@` and spaces, then compares the host exactly or as a subdomain of an allowed host. Refusing odd URLs is safer than trying to interpret them.