leaking url variable