fix encoded URL issue + security related settings