http refactoring + security