bugfix header location
security changes