joining classes should be server side function to verify security existing error

[Spencer-Mosley]

this will be fixed in premium and only vulnerbale in free version so can move to lower in priority