added some initial documentation
refactored (again) security framework, changed GET methods to POST ones