more work in security attributes, some fixes and clear idea of what can go through, attributes are now being passed through the aggregater