http/4_security.md reviewed