security - access control, refactor, tests