corrected url restriction in js