some api docs and small security update