Assorted security fixes

A number of security fixes brought to light by yesterdays pentest. There's likely more to come after the report. @threedaymonk @novotnyjakub