remove insecure package, allow post creation from client