do not replace client id if url should not be signed