fixed redirect security loop