Use check_url() instead of check_plain()

There were a couple of incidents where check_plain() was called to validate a URL instead of check_url(). Here is a patch.

Thanks for this module - I use some code of it in leech - see _leech_retrieve_favicon() .

I replaced the check_plain() calls in question to check_url() in leech. Works fine.

I will have also posted a patch for 4.7.x