security fix: propagate shellsafe in dispatcher!