more security refactoring