update security rules to match reality
add ?CLEAR hack