disable picture url secure params