Remove valid-url dependency

[robfromboulder]

This is breaking on npm version 5, and we barely depend on this. Let's copy out the code on which we depend and remove the module dependency (but keep the license notice and clearly mark the copied code as originating from valid-url).