code: function assertObviousUnsafeUrl(urlString) {
    if (urlString) {
      if (parseUrl(urlString).protocol.indexOf('script') != -1) {
        throw new Error('unsafe "' + urlString + '"');
      }
    }
    return urlString;
  }
docs: Asserts that a given url is not an obvious script URL. This is not intended
  as a complete verification. The complete verification is left up to the
  host before `accept()` method is called.
  @param {?string} urlString
  @return {?string}