fixes for secure json loading