backport url reverse security fix from 1.4.x