fix typo and add more security on API