make more de/serializers optional for security reasons

more security fixes