fix secu issue with url