fix recording activity security hole in manifest