fix blatant lack of security against replay attacks