blocked warning and password if hosted from external app