add some url security rules