fix forwarding and close hole in security
Merge remote-tracking branch 'origin/master'