limit the template nesting level by security