Fix Fantasy-prefix security hole (2nd attempt)