fix security issue introduced by 4967:04543ed0bbdc: attributes explicitly set by hooks should not be checked by security hooks

Experiment with the search bar. Try queries like "card sometextualcontent" or
"card wikiid index" or "345".