security fix for saving customizer settings