added tests and fixed security bug