Clean up security notes a bit; add strdup stuff