some added security on create and update