fixed security issue where entering urls directly was not being caught