security fixes + ui polish