fix possible xss in add_remote