disallow extra stuff on the WS join URL