fixed security bug not allowing external form