first, rough version

@carlaschroder lots to do still - I'd like feedback especially from Jennifer, but also @dragotin @karlitschek @danimo @LukasReschke @PVince81 and others ;-)

Mostly on the gaps and the questions in there...
Security is set by Lukas or someone else from the security team. This is only for security problems and mit for other 'bad' bugs