fix a few security issues