fix removeSong security bug