update to manifest v2, security changes