work on view; security not done