another url parse bug and x-frame condition