fix(onboard): reject an unsafe custom endpoint URL before any mutation

fix(onboard): reject an unsafe custom endpoint URL before any mutation #18558