I could see how adding javascript to the disallowed schemes would be a good idea, but I don't see what the foreach addition would provide over the current grep solution. Seems like a lot more code to do the exact same thing.

BTW--In the foreach case, you're right about needing an explicit label.