fixed some security holes