[Security] query string can't be used in security.access_control > path#12605