Comments to fix 500, how Choices are considered and saved as correct in the DB, and note on JSON endpoint array security flaw