fix secu issue with url, update tests