secured unserialize

- update for BC-compatible unserialize
- add tests