added a few restrictions around url injections