fix "ghost redirect"
fix things
turn static encryption key into dynamic