security reworked.
update docs, controllers, add http request verifier and token factory
fix doc.