change from server-side URL parameters to client-side for security