proper json get requests and fixed security hole