major security update to url parameters