fixes and brute force attack prevention (not tested)