security fix for url