security filter for /wx/*