clean up comment
test security policy re http, drop dead code
lint