hardening permissions and small cleanup