custom error page + security fixes