fix some security bugs