security fixes on register/login