* added TODOs
* fixed security issue