more work on secure string