Security fix: prevent injecting MODx code in the URL.