Fix url id param code to check security. Use top or self.