Currently requireCapability will ignore ALL input from anyone without this capability. Its purpose is to prevent following of links by bad actors, but some domains are pretty much safe. For example, imgur or reddit.
Allow domain whitelisting to bypass requireCapability