more refactoring, security not working