add security
fix css location