security check for invalid url
introduce new argument allowsourceupdate