prevent accessing wrong image url