Fix security problem with expand/collapse