Wait WTF, `javascript:` URLs are acceptable in the CSS `url` property??

From the SO post:

> url('javascript: eval(evil)');