fixed first security hole for if showMeAnother=1 is specified in url
another security hole plugged when SMA is enabled, but not for that problem
another security hole plugged