fixed #934: Possible to run any action by passing module/action parameters to invalid URL