misc bug and security hole fixes