fix security issue with referral hash