security work in progress, plus adding some tests