improve Model.find security in controllers
most of Steve's first fixes implemented
.gitignore is now working
devnotes addition