More work on http/pb security