prevent injection of requests labeled as private