access control on collections. nonce check. minor fixes
console logs removed