Server-side: security refactoring