fixed security rules, starting to work with UI