disable allow_call_time_pass_reference in php; prepare add token in add/delete/update form; add validate for 'server alias'; better 'die' display;