add security checks for url spoofing