restoring escaping on callback, don't allow GET requests