This tests that javascript: urls in an embed tag do not get executed.