move this test to note it was in response to a security flaw