web/security: updates for 2.*