protect against redirects