client server separation, security fixed