User redirected to PayPal even if it is hidden?