request uri is not validated