Allow arbitrary URLs, expect arbitrary code execution

This is stupid. They reported that clicking on link to an .exe file will run that file after download.