Added copy to arrange security check.

Added logic to prevent users from abusing copy to transfer endpoint.