Prevent accidental file:// usage

In some cases when this module is used with unsanitized data (possibly by accident), the ability to access "file://" is a major security issue. Please add a flag to explicitly permit file:// access, which IMO should be `false` by default. Also, please provide for an easy way to inject my own URL sanitization function right before that URL is being used. Thanks!