beforeFilter security fixed