Some security fixes, getting rid of the JSON endpoint.