fix security issue when redirecting