restructured, use Settings interface for config, use protection API