protect URL pre-populated fields