security related fixes

found these by accident :D