[security] fixed back url verification